maricopa county internal audit department report... · 2002 achievement award performance measure...

Fiscal Year 2003

Maricopa County

Internal Audit Department

County Auditor’s Annual Report

Return on Investment

Internal Audit’s economic

impact continues to exceed its

cost by a large margin.

A well run internal audit

function is an investment that

benefits County management

and citizens.

IA Cost vs IA Savings Produced

Audit Budget

Savings produced by

Internal Audit

0

1

2

3

4

5

6

7

FY 95-96 FY 96-97 FY 97-98 FY 98-99 FY 99-00 FY 00-01 FY 01-02 FY 02-03

Mill

ion

s To: Fulton Brock, Chairman, Board of Supervisors Don Stapley, Supervisor, District II Andrew Kunasek, Supervisor, District III Max W. Wilson, Supervisor, District IV Mary Rose Wilcox, Supervisor, District V

From: Ross L. Tate, County Auditor

Date: October 31, 2003

Executive Summary

Internal Auditors are a Good Investment

Internal auditing is a good investment for operational improvement and fraud deterrence. The presence of internal auditors can deter employees from committing fraud because of the perceived danger of getting caught. When you combine the cost savings from fraud and error detection by auditors with the deterrent effect, the value of auditing activities is even more evident.

Strong Internal Audit Function Limits Exposure

The Congress-enacted Sarbanes-Oxley Act of 2002 prompted the following, according to Forbes:

♦ The accounting industry’s reorganization separating auditing and consulting functions

♦ Companies’ (including non-profits) compliance costs will increase, as they fix their control systems and hire compliance executives

♦ New laws and regulations have emerged that are likely to elicit more frequent and severe director and officer litigation

Internal Audit’s Mission

To provide objective,

accurate, and meaningful

information about County operations so

the Board of Supervisors can make informed decisions to better serve County

citizens.

Fulton Brock, Chairman of the

Board of Supervisors,

joins Internal Audit to celebrate

winning three national awards

in FY2003.

Audit Received 3 Noted National Awards for Our FY03 Work

Internal Audit Writes an Article Seen Across the Country

The Government Finance Officers Association (GFOA) asked Internal Audit to write an article for its February 2003 Government Finance Review. Tate and other audit staff wrote a four page article titled “Performance Measure Certification in Maricopa County.” The County’s article was used as the lead story in this national publication.

Raising the Bar for All Organizations

The Center for Association Leadership holds that while the Act's provisions are specifically applicable to publicly held companies, Sarbanes-Oxley has clearly raised the bar for the financial and governance practices of all organizations, for-profit and not-for-profit alike. During this year, the Center consulted with many of its over 350 exclusively not- for-profit clients in reviewing provisions of the Act for voluntary adoption to enhance their best practices and support an atmosphere of accountability and transparency. Maricopa County Leaders Recognize Value

Maricopa County leaders have long recognized the value of internal controls, accountability, and transparency. They have wisely invested in an independent internal audit function. Our audit office is considered independent because we report directly to the Board of Supervisors. We also have an advisory reporting relationship to the Citizen’s Audit Advisory Committee, which the Board established in 1997.

Organizational Independence Internal Audit reports directly to the Board of Supervisors,

with an advisory reporting relationship to a Citizen’s Audit Advisory Committee.

Board of Supervisors

Fulton Brock District I

Don Stapley District II

Andrew Kunasek District III

Mary Rose Wilcox District V

Max W. Wilson District IV

County Management Internal Audit

Citizen’s Audit Advisory Committee Citizen’s Audit Advisory Committee (see photo at right)

Seated left to right: Chairperson Ralph Lamoreaux, District I Appointee Marilyn Anderson, District III Appointee Jill J. Rissi, District II Appointee Vincent Harder, District IV Appointee Richard Lozar, District V Appointee

Standing left to right: Tom Manos, County Chief Financial Officer Dennis Levine, Office of the Auditor General Ross L. Tate, County Auditor William S. Knopf, Office of County Counsel

Internal Audit

County Auditor

Ross L. Tate

Joan Simpson

Information Technology Consultant

Sandy Chockey

Audit Team

Clockwise from top:

Joe Seratte Laurie Aquino Patra Carroll Susan Huntley Tom Fraser Louise Wild (Not pictured: Cathleen Galassi)

Audit Team

Left to Right:

Christina Black Richard Chard Eve Murillo John Schulz Kimmie Wong Susan Adams

Office Manager

National Awards Received in FY 2003

Internal Audit is recognized for achieving results as demonstrated by the following awards in FY 2003:

2002 Special Project Award Nat’l Assoc. of Local Government Auditors Performance Measure Certification Program

Performance Measure Certification Internal Audit created and implemented the Performance Measure Certification program in response to Maricopa County’s adoption of a performance management system, Managing for Results. We review inputs, outputs, efficiency, and progress toward outcome goals. We assign and report certification ratings to County leaders and top management.

Nat’l Assoc. Conference, Toronto, Canada

Board of Supervisors Meeting

2003 Distinguished Local Government Leadership Award Association of Government Accountants Ross Tate, County Auditor Background on Award

Each year, the Association of Government Accountants presents a maximum of two crystal awards to local government professionals who exemplify and promote excellence in government financial management. The award recognizes the outstanding leadership of individuals in local government that led to improved financial management practices, policies, systems or operations and consistently exhibited the highest personal and professional standards.

Previous awards are . . .

2002 Award of Excellence Gov’t Finance Officers Association

Performance Measure Certification Program

Nat’l Assoc. of Local Government Auditors

2001 Special Project Award Financial Condition Report

2000 Special Project Award Cash Handling Workshop

National Association of Counties

2002 Achievement Award

Performance Measure Certification

2001 Achievement Award Financial Condition Report

2001 Achievement Award

“Got Controls” Management Bulletin

2000 Achievement Award Cash Handling Workshop

2002 Commitment to Quality Improvement Award Institute of Internal Auditors Maricopa County Internal Audit

Background on Award

This award recognizes internal audit activities that demonstrate an ongoing commitment to improving the quality of internal auditing in the areas of professional excellence, quality of service, and professional outreach.

Maricopa County is one of only 22 internal auditing departments throughout the world to receive the award for 2002. Other 2002 award winners include Union Pacific Corporation, Federal Reserve Bank of Cleveland, New York Life, California Institute of Technology, and Oregon Judicial Department.

IIA Seminar, Phoenix, Arizona

Board of Supervisors Meeting

Control Bulletins Our one-page “Got Control” bulletins communicate important control issues to County executives, managers, and employees.

This product received an award:

% National Association of Counties Achievement Award (2001)

Control Self Assessment Control Self Assessment workshops help employees determine their department’s control weaknesses and risks. These workshops feature

entertaining videos with top- level County management and elected officials demonstrating the right way (and the wrong way) to handle cash, monitor contracts, and process payables.

This product received two awards:

% National Association of Local Government Auditors Special Project Award (2000) % National Association of Counties Achievement Award (2000)

Financial Condition Report We annually assess and report on Maricopa County's financial condition in a highly visual, user-friendly, annual Financ ial Condition Report. This report displays key

financial trends and compares Maricopa's trends with those of 10 western US counties.

This product received two awards:

% National Association of Local Government Auditors Special Project Award (2001) % National Association of Counties Achievement Award (2001)

Performance Measure Certification We created and implemented the Performance Measure Certification program in response to Maricopa County’s recent adoption of a performance management system, Managing for Results. We review inputs, outputs, efficiency, and progress toward

outcome goals. We assign and report certification ratings to County leaders and top management.

This product received three awards:

% National Association of Counties Achievement Award (2002) % Government Finance Officers Association Award for Excellence (2002) % National Association of Local Government Auditors Special Project Award (2002)

Video StarringCounty

management….

Award Winning Products

As seen on the GASB

website

The use of Information Technology (IT) throughout the County can increase productivity but can also increase the risk of unauthorized changes, data destruction, errors, unauthorized access to confidential data, downtime, and fraud. Because of these risks, we developed an IT audit function staffed by dedicated, experienced IT auditors who perform the following activities:

Continuous Monitoring IT audit staff continuously monitors certain types of County expenditures to ensure that

County resources are used appropriately. These monitoring efforts focus on high-risk areas, such as routinely checking vendor payments. If resources are available, this

function will be expanded to use fraud detection software to monitor and assess p-card (credit card) payments.

IT General Controls and Application Audits IT General Controls and Application audits focus on reviewing the adequacy of each

department’s computer system controls to ensure County data integrity, confidentiality, and availability. Audit examples are: payroll application, financial application, and data center operations.

Virus Detection / Vulnerability Assessments Viruses and other types of computer attacks can be a serious threat to County data. The

County can deter these dangerous attacks by using aggressive virus protection systems and appropriate security measures. IT audit staff regularly reviews computer virus detection efforts and system vulnerability to ensure that proper controls are in place to reduce the risk of attack. An attack would cost the County a productivity loss up to $126,350 each hour.

System Development Assessments We encourage County departments to use approved systems development

methodologies when they develop new systems or enhance existing systems. These methodologies include: reviewing project management controls, logical access controls, test and training controls, and project implementation controls. IT audit staff is currently involved with monitoring the Integrated Criminal Justice Information System (ICJIS) development project.

Web Page Management We designed our Internal Audit web page to provide useful information to County management, employees, citizens and peers. Our website contains copies of our reports plus some tools we use for effective auditing.

About Us

Information Technology Services

Mission Internal Audit’s mission is to provide objective, accurate, and meaningful information about County operations so

the Board of Supervisors can make informed decisions to better serve County citizens.

Maricopa County Internal Audit Department “Do the right things right!”

Page

Performance Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Inputs / Resources & Outputs . . . . . . . . . . . . . . . . . . . . . . . . 5

Appendices:

A ~ Professional Staff Biographies . . . . . . . . . . . . . . . . . 9

B ~ Project Summaries . . . . . . . . . . . . . . . . . . . . . . . . . 13

C ~ Other Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

D ~ Single Audit Reviews . . . . . . . . . . . . . . . . . . . . . . . 27

E ~ Internal Audit Department Profile . . . . . . . . . . . . . . 28

F ~ Citizen’s Audit Advisory Committee Charter . . . . . . 31

G ~ Internal Audit Department Charter . . . . . . . . . . . . . 33

Table of Contents

1 Maricopa County Internal Audit County Auditor’s Annual Report

Programs Internal Audit is Managing for Results (MfR) through two programs: Audit Services and Management Services. Audit Services Program

Provides independent assessments and recommendations to the Board of Supervisors and County management so they can make informed and fiscally prudent decisions.

Management Services Program

Provides strategic information and education to County officials and employees so that they can perform their jobs more effectively.

Key Performance Measures Internal Audit (IA) has five key performance measures (with FY03 results): Audit Services Program

♦ 99.8 % of IA recommendations concurred with by clients

♦ 90 % of IA recommendations implemented within three years

Management Services Program

♦ 100 % satisfaction rating from customers indicating consulting services delivered by IA helped them do their job

♦ 90 % satisfaction rating from customers indicating educational efforts (newsletters, courses, etc.) help them do their job more effectively

♦ 100 % overall approval rating for Internal Audit’s strategic information reports by Board of Supervisors and key County management

The following pages illustrate Internal Audit’s results.

Performance Results

Maricopa County Internal Audit County Auditor’s Annual Report 2

Audit Impact Description

MIHS Finance Office $ 489,680 Duplicate and potential duplicate payments; prompt payment discounts were not taken.

MIHS Senior Select Health Plan 426,000 Duplicate and potential duplicate claim payments.

Clerk of the Superior Court 200,000 Unidentified cash balances carried on the books for several years.

Medical Examiner 159,518 Rates and fees do not recover costs.

Virus Detection 126,350 A centralized monitoring function which pro-vides virus detection/protection consistency throughout the County can prevent computer down-time related to viruses.

MIHS Durable Medical Equipment Contract

116,931 Overpayments to vendor.

Flood Control District 33,035 Lease payments due from City of Tempe; avoided permit fines.

Transportation 20,975 Inaccurate billings for co-shared costs.

Elected Officials Entrance / Exit 7,200 Open bonds that were not remitted to the County Treasurer’s Office.

Countywide Contracts 5,000 Contractor overcharges.

Solid Waste Management 1,475 Contractor overpayments; missing change fund.

$ Recovery & Cost Avoidance Total: $ 1,586,164

Audit Dollar Recoveries

The table below shows FY 2003 audit projects that resulted in significant recoveries, savings, cost avoidance, or other economic impact.

Economic Impact Although the numbers vary each year, Internal Audit’s economic impact continues to exceed its cost by a large margin, as shown at right. A well run internal audit function is an investment that benefits County management and citizens. (Note: Graph includes co-source dollars.)

Our Cost vs. The Cost to Outsource the Audit Function FY 2003 audit work would have cost the County twice as much if external auditors had been used instead of internal audit staff. (Note: Graph includes co-source dollars.)


Other Significant Economic Impacts Internal Audit’s work is not always measurable; for example, improved internal controls may result in cost savings. We also work on high impact projects that are not quantifiable. Here are some audit projects that cont ributed to positive changes or positive results for the County. ♦ Financial Condition Report

The County Administrative Officer refers to the Financial Condition Report frequently. One report result was a $34 million adjustment to reported Medical Center Fund Equity.

♦ MIHS Cash Analysis

Our Advisory Memos alerted top management and the Board of Supervisors on Maricopa Integrated Health System’s (MIHS) deteriorating cash position. As a result, management implemented an action plan to alleviate further deterioration (including delaying capital expansion and terminating the Hospital management contract).

IA Cost vs IA Savings Produced

Audit Budget

Savings produced by Internal Audit

0

1

2

3

4

5

6

7

FY 95-96 FY 96-97 FY 97-98 FY 98-99 FY 99-00 FY 00-01 FY 01-02 FY 02-03

Mill

ion

s

FY03 Cost Comparison(Millions)

0 1 2 3 4

Projected Cost to OutsourceInternal Audit's Work

Internal Audit Budget

“While an audit can be quite stressful for the parties being audited, the team conducting this audit was very considerate of th e environment and the limitations of the equipment and staff involved. The findings were very useful and will assist the … office in its effort of continuous improvement.”

“The audit analysis and recommendations were reasonable and professionally conducted in a very difficult environment. ‘Hat’s off’ to the audit department for staying the course and doing the right thing.”

“I felt the audit team always maintained the highest level of professionalism and integrity.”

“The Performance Measure Report card is quite useful to us as we continue with the MFR process. Thanks.”

“This is a superb document in every way which reflects some truly excellent work. Great job!”

“The auditors were a pleasure to work with. They were very flexible with adjusting to my work schedule. I believe the process went pretty well and should be even better next year.”

“We appreciate the objective reviews by your proficient staff.”

“Awesome instructor and video. Way to go!”

“The auditor impressed me with her thoroughness and professionalism.”

“I am glad the instructor had videotaped scenarios of examples of do’s and don’t’s —very helpful and easy to remember information.”

“The auditor was really good in the presentation of the workshop.”

What Did Our Customers Say? Quotes below are taken from FY 2003 customer surveys:


The Maricopa County Management Team reported they were 82% satisfied with Internal Audit’s mission fulfillment.

— Maricopa County Research & Reporting, FY03

Inputs / Resources & Outputs

Cost Per Audit Employee Our investment (cost) per audit staff member is low compared to our benchmark counties.

Internal Audit has produced good results with minimal resources (our staff investment is more economical than our benchmark counties).


Budget The County’s internal audit costs remain low compared to other counties. The benchmark average is $1.95 million and the national audit department budget average for local governments is $1.79 million. (Note: National averages are taken from the 2003 Fairfax County survey of 45 of the largest local government audit departments.)

Budget Comparisons to BenchmarksFY 2002-03 (Millions)

$0

$1

$2

$3

$4

$5

Multnomah Salt Lake Maricopa Clark Harris San Diego Orange Dallas

FY03 Budget Average

Cost per Internal Audit EmployeeFY 2002-03 (Thousands)

$0

$20

$40

$60

$80

$100

$120

Salt Lake Harris Maricopa San Diego Clark Orange Dallas Multnomah

Budget per Employee Average

Ratio of Internal Auditors to County Budget This ratio represents each benchmark’s audit coverage within their county. The smaller the bar graph is, the better coverage the County receives from their Internal Audit function.


Outputs Internal Audit’s FY 2003 outputs consist of the number of audit reports issued, consultations provided, educational classes taught, and strategic information reports issued. Note: Figures are based on the Annual Audit Plan and may not correspond to MfR reported data.

Audit Services Program: 31

Management Services Program:

Consultation Activity 13

Education Activity 12

Strategic Information & Reporting Activity 7

TOTAL: 63

Internal Auditors to County Budget RatioFY 2002-03 (Millions)

$0

$50

$100

$150

$200

$250

$300

$350

Orange Clark Maricopa Multnomah Harris San Diego Salt Lake Dallas

Audit Coverage Average

Staff Size Maricopa County has less internal auditors compared to the benchmark average of 17.5 auditors and the national average of 20 auditors.

Auditor Comparison to BenchmarksFY 2002-03

0

5

10

15

20

25

30

35

40

Multnomah Salt Lake Clark Maricopa Orange Harris San Diego Dallas

# of Auditors Average

Vision Internal Audit’s vision is to facilitate positive change

throughout County operations while ensuring that public resources are used for their intended purpose.


Appendices


Appendix A: Professional Staff Biographies

Internal Audit employed the following individuals during FY 2002-2003.


D. Eve Murillo, Audit Manager

Ms. Murillo is a Certified Public Accountant and a Certified Fraud Examiner. She has a bachelor's degree in Liberal Arts from the University of Illinois, a Masters in Business Administration from Florida Institute of Technology, and 14 years of accounting and internal auditing experience. Ms. Murillo is a member of the Arizona Chapter of the Association of Certified Fraud Examiners, Arizona Local Government Auditor's Association, Arizona Society of CPAs, and the Institute of Internal Auditors.

Ross L. Tate, County Auditor

Mr. Tate is a Certified Internal Auditor, Certified Management Accountant, and Certified Government Financial Manager. He has a bachelor’s degree from Brigham Young University in Business Operations & Systems Analysis and 17 years of professional internal auditing experience. Mr. Tate is an active member of the National Association of Local Government Auditors, the Institute of Internal Auditor’s Phoenix Chapter, and the Arizona Local Government Auditor’s Association.

Joe M. Seratte, Audit Manager

Mr. Seratte is a Certified Public Accountant, Certified Internal Auditor, and has a certification in Control Self-Assessment. He holds an Accounting degree from Oklahoma State University and a Master's degree from the American Graduate School of International Management (Thunderbird) in Glendale, Arizona. He has 22 years experience in auditing, finance and accounting and is a member of the American Institute of Certified Public Accountants and the Institute of Internal Auditors.

Joan Simpson, Office Manager

Ms. Simpson has a bachelor’s degree in Social Science with a major in Political Science from Milton Keynes University in the United Kingdom. She has professional experience in both the private sector and in government. She also has developed her technical skills in the use of software programs to further enhance her productivity within the office.

George Miller, Audit Manager

Mr. Miller has 20 years of county government internal auditing experience and is a Certified Government Financial Manager. He has a Bachelor’s degree in Business Administration from Michigan State University and an MBA Degree from Western Michigan University. He was the 2000 President of the Arizona Local Government Auditor's Association. He also serves as Vice Chairman of the County’s Deferred Compensation Committee. Mr. Miller retired from the County in January 2003.

Sandy M. Chockey, Audit Manager - Information Technology

Mrs. Chockey is a Certified Information Systems Auditor. She has a degree in Business Administration and over 20 years of professional information systems auditing experience. Mrs. Chockey has served as past Vice President, Treasurer, and Board Member of the local Information Systems Audit and Control Association. She is also a member of the Arizona Local Government Auditor’s Association. Mrs. Chockey left the County in August 2003 to work for a priva te firm.

Richard L. Chard, Senior Auditor

Mr. Chard is a Certified Public Accountant and has a History degree from the University of Redlands and postgraduate work in accounting and public administration through Arizona State University and Western International University. Before joining Internal Audit seven years ago, he worked five years in Maricopa County's Department of Finance and Health Systems Finance. He is active in Toastmasters International and is currently the organization’s Arizona Division Treasurer.


Cathleen L. Galassi - Senior Auditor

Ms. Galassi has a bachelor’s degree in Philosophy from Loyola Marymount University, California, and post-graduate work in organizational psychology. She has 17 years of internal audit experience, including audit management at financial institutions, and 10 years of accounting and budgeting at non-profit institutions. Ms. Galassi’s experience inc ludes participation on merger and acquisition teams and system conversion projects. Ms. Galassi is a member of The Institute of Internal Auditors.

John Schulz, Senior Auditor

Mr. Schulz has 24 years of experience in program evaluation, budgeting and financial administration within healthcare, law enforcement and government. He holds a degree in Government from University of Maryland and a Masters of Public Administration from Arizona State University. He is a member of the Institute of Internal Auditors, Arizona Local Government Auditors Association and the Association of Certified Fraud Examiners.

Susan Adams, Senior Auditor - Information Technology

Ms. Adams is a Certified Information Systems Auditor. She has a bachelor's degree in Accounting from Utah State University and an MBA from the University of Utah. She has 11 years professional experience in accounting and audit with 5 years as an Information Systems auditor. Ms. Adams is currently serving as Secretary for the Information Systems Audit and Control Association's Phoenix Chapter and is also a member of the Arizona Local Government Auditor’s Association.


Kimmie Wong, Associate Auditor

Ms. Wong has a bachelor's degree in Business Administrative Services from Arizona State University. She has over 7 years of experience reviewing grant audits and 7 years of professional internal auditing experience. She is working towards a Masters of Public Administration degree. Ms. Wong is a member of the Arizona Local Government Auditor's Association and the Association of Certified Fraud Examiners' Arizona Chapter.

Thomas L. Fraser, Senior Auditor - Information Technology

Mr. Fraser is a Certified Fraud Examiner who holds degrees in Business Administration and Business Management. He has 11 years of accounting and internal audit experience. Mr. Fraser is a member of the Institute of Internal Auditors, Arizona Chapter of the Association of Certified Fraud Examiners, and is the President of the Arizona Local Government Auditor’s Association.

Patra E. Carroll, Associate Auditor

Ms. Carroll is a Certified Public Accountant candidate with over 8 years of financial, performance, compliance, and tax auditing experience within both state and county governmental entities. She has a bachelor's degree in Accounting from Arizona State University and is a member of the Arizona Local Government Auditor's Association and American Society for Public Administration.

Susan Huntley, Associate Auditor

Ms. Huntley has a bachelor's degree in Psychology and a Masters in Public Administration from the University of North Florida. Ms. Huntley has 21 years of professional experience which includes quality assurance, auditing, systems implementation and design. Ms. Huntley is a member of the Arizona Local Government Auditor’s Association and the National Institute for Government Procurement.


G American Institute of Certified Public Accountants (AICPA)

G American Society for Public Administration (ASPA)

G Arizona Local Government Auditors Association (ALGAA)

G Arizona Chapter of the Association of Certified Fraud Examiners (CFE)

G Arizona Chapter of the American Society for Public Administrators

G Information Systems Audit and Control Association (ISACA)

G Institute of Internal Auditors (IIA)

G Maricopa County Adjunct Faculty

G Maricopa County Blood Drive

G Maricopa County Deferred Compensation Committee

G National Association of Certified Fraud Examiners (CFE)

G National Association of Local Government Auditors (NALGA)

G National Institute for Government Procurement

G Toastmasters International

Internal Audit staff members participate in many professional and service organizations, as shown to the right: Please see Appendix E for Internal Audit’s educational requirements.

Christina Black, Associate Auditor

Ms. Black is a Certified Government Audit Professional with over 7 years of professional internal audit experience and 10 years of accounting and revenue auditing experience. She has a bachelor's degree in Accounting from Missouri Western State College and is a member of the Arizona Chapter of the Association of Certified Fraud Examiners, Arizona Local Government Auditor's Association, and the Institute of Internal Auditor’s Phoenix Chapter, where she serves as Chair on the Awards Committee.

Louise Wild, Staff Auditor

Ms. Wild graduated Suma cum laude from Arizona State University West with a bachelor’s degree in Accounting. She achieved the 8th highest score in one sitting on the 2002 Certified Public Accountant examination. She is a member of the Institute of Internal Auditors, Arizona Local Government Auditor’s Association, and an affiliate member of the American Institute of Certified Public Accountants. Ms. Wild left the County in July 2003 to work for a CPA firm.

Laurie Aquino, Staff Auditor

Mrs. Aquino has a bachelor’s degree in Accounting from Arizona State University West. She has three years of professional experience in accounting and business. Mrs. Aquino is a member of the Institute of Internal Auditor’s Phoenix Chapter and the Arizona Local Government Auditor’s Association.

Appendix B: Project Summaries

♦ Assessor’s Office 14 ♦ Clerk of the Superior Court 14 ♦ Computer Virus Detection 14 ♦ Continuous Monitoring (P-Card) 15 ♦ Contracts, Countywide 15 ♦ County Attorney’s Office 15 ♦ Countywide Fixed Assets 16 ♦ Customer Service Survey 16 ♦ Entrance & Exit of Elected Officials 16 ♦ Facilities Management Inventories 17 ♦ Financial Condition Report FY02 17 ♦ Flood Control District 17 ♦ Grant Compliance Review 18 ♦ Grant Management 18 ♦ Health Care Mandates 18 ♦ Integrated Justice System 19 ♦ Internal Audit Peer Review 19 ♦ Justice Courts Review and MAS 19 ♦ Justice Facilities Expenditures 20

♦ Maricopa County Performance 20 ♦ MCSO Warehouse/Food Services 20 ♦ Medical Examiner 21 ♦ MIHS Cash Monitoring 21 ♦ MIHS Claims System 21 ♦ MIHS Durable Medical Equipment 22 ♦ MIHS Finance/Accounting System 22 ♦ MIHS Medical Supplies Inventory 22 ♦ MIHS Senior Select Health Plan 23 ♦ Network Vulnerability 23 ♦ Office of Management & Budget 23 ♦ Performance Measures 24 ♦ Random Cash Counts 24 ♦ Risk Management 24 ♦ Solid Waste Management 25 ♦ Stadium District 25 ♦ Transportation 25

Report Title Page

Report Title Page


Assessor Office ~ February 2003

The Maricopa County Assessor is an elected official whose primary duties include determining the full cash and limited value of all taxable property in the County,

preparing the assessment roll showing the ownership of all property and assessments, computing the levy limit, and determining the limited property value within each school district.

Significant Issues § Testing of approximately 350,000 properties within the County found no unassessed parcels. § The Assessor Office’s automated cash receipt system does not include controls sufficient to

safeguard revenues. § Four of the five Assessor Office’s key results measures could not be tested due to factors that

prevented certification.

37

THW

AY

R O A D

37T

HP

L

B L O O M F I E L D

C H A R T E R O A K

37T

HS

T

O A K R O A D

PL

3 4

3 5

3 6

4 2 4 3 4 4

4 5

4 6

4 7 4 8 4 9 5 0 5 1 5 2 5 3

6 06 16 26 36 46 5

6 6

6 7

6 86 97 07 1

7 8 7 9 8 0 8 1 8 2 8 3

8 4

8 5

8 6 8 7 8 8 8 9

1 2 61 2 51 2 41 2 31 2 21 2 11 2 0

1 1 3 1 1 2 1 1 1 1 1 0 1 0 9 1 0 8 1 0 7

1 0 6

1 0 5

1 0 4 1 0 3

1 0 2

1 0 1

1 0 0

1 6 6 - 5 6 - 0 3 4

1 6 6 - 5 6 - 0 3 5

1 6 6 - 5 6 - 0 3 6

1 6 6 - 5 6 - 0 4 2 1 6 6 - 5 6 - 0 4 3 1 6 6 - 5 6 - 0 4 4

1 6 6 - 5 6 - 0 4 5

1 6 6 - 5 6 - 0 4 6

1 6 6 - 5 6 - 0 4 71 6 6 - 5 6 - 0 4 81 6 6 - 5 6 - 0 4 91 6 6 - 5 6 - 0 5 01 6 6 - 5 6 - 0 5 11 6 6 - 5 6 - 0 5 21 6 6 - 5 6 - 0 5 3

1 6 6 - 5 6 - 0 6 01 6 6 - 5 6 - 0 6 11 6 6 - 5 6 - 0 6 21 6 6 - 5 6 - 0 6 3

1 6 6 - 5 6 - 0 6 41 6 6 - 5 6 - 0 6 5

1 6 6 - 5 6 - 0 6 6

1 6 6 - 5 6 - 0 6 7

1 6 6 - 5 6 - 0 6 81 6 6 - 5 6 - 0 6 91 6 6 - 5 6 - 0 7 01 6 6 - 5 6 - 0 7 1

1 6 6 - 5 6 - 0 7 81 6 6 - 5 6 - 0 7 91 6 6 - 5 6 - 0 8 01 6 6 - 5 6 - 0 8 11 6 6 - 5 6 - 0 8 2

1 6 6 - 5 6 - 0 8 3

1 6 6 - 5 6 - 0 8 4

1 6 6 - 5 6 - 0 8 5

1 6 6 - 5 6 - 0 8 6 1 6 6 - 5 6 - 0 8 71 6 6 - 5 6 - 0 8 81 6 6 - 5 6 - 0 8 9

1 6 6 - 5 6 - 1 0 0

1 6 6 - 5 6 - 1 0 1

1 6 6 - 5 6 - 1 0 2

1 6 6 - 5 6 - 1 0 31 6 6 - 5 6 - 1 0 4

1 6 6 - 5 6 - 1 0 5

1 6 6 - 5 6 - 1 0 6

1 6 6 - 5 6 - 1 0 71 6 6 - 5 6 - 1 0 81 6 6 - 5 6 - 1 0 91 6 6 - 5 6 - 1 1 01 6 6 - 5 6 - 1 1 11 6 6 - 5 6 - 1 1 21 6 6 - 5 6 - 1 1 3

Clerk of the Court ~ September 2003

The Clerk of the Superior Court (COSC) is the official record-keeper of the court and acts as a safeguard and processor of all monies collected. .

Significant Issues § The COSC did not establish adequate vault controls, thereby placing citizens’ property held in

trust, at risk. § Unreconciled amounts, currently listed at $1.6 million and held in Superior Court bank accounts,

cannot be validated to Court operations and should be transferred to an appropriate fund. § The Minimum Accounting Standards review resulted in eight exceptions to criteria established by

the Supreme Court of Arizona, Administrative Office of the Court; two of which were material.


Computer Virus Detection ~ April 2003

A computer virus is code that has been purposely written to cause damage to software or data files, from deleting files to rendering a computer unusable. Computer viruses continue to appear at unprecedented rates – over 70,000 viruses

are known to exist with approximately 1,200 new viruses discovered every month. Viruses reportedly caused billions of dollars in damage in 2001, due to network crashes and related costs.

Significant Issues § Overall, the County anti-virus software procedures appear to be adequate to prevent and detect the

existence or spread of computer viruses. § Anti-virus software has not been installed on some County web servers and laptop computers. § County policy does not include a centralized monitoring and reporting function that could enhance

existing virus prevention efforts.

Continuous Monitoring: P Card ~ July 2003

Continuous monitoring began in response to a January 2000 audit of the County’s financial system. The audit identified areas within the County open for

potential abuse. Internal Audit began monitoring these areas for large data inconsistencies with a powerful software program called Audit Command Language (ACL). Internal Audit developed trend data for comparison purposes. Variances are investigated to determine cause and ultimately the effect. ACL analyzes transactions and identifies data variances or inconsistencies that may indicate problems. Three areas were considered for monitoring: the use of miscellaneous vendor transactions, purchase card controls, and credits issued via County merchant credit card terminals. Significant Issue One notable issue is that 31 purchase cards are currently held by non-employees.

Contracts, Countywide ~ July 2003

Internal Audit annually reviews controls and transactions for a selected group of County contracts. Although we do not focus on specific offices or departments,

several of the contracts involved a single department. While the Materials Management Department is responsible for procurement and oversight of all County (non MIHS) contracts, each user department must monitor vendor performance and contract usage on a routine basis. Significant Issues § Expenditures related to four contracts stayed within contract-specified prices and expenditure

limits. § The Department of Transportation’s change initiative vendor overcharged the department

approximately $10,000 from FY 2001 to FY 2003. § Two contracts were not effectively monitored.


County Attorney’s Office ~ June 2003

The Maricopa County Attorney’s Office (MCAO) is the County’s chief prosecuting agency, responsible for prosecuting felonies that occur in Maricopa County and all crimes in unincorporated areas. In addition, MCAO provides legal

counsel for the Board of Supervisors and County departments, conducts criminal investigations, provides assistance to law enforcement agencies, and provides victim’s rights information and assistance to all victims of crimes prosecuted by MCAO. Significant Issues § The Check Enforcement Bureau has implemented appropriate controls over cash receipts, bank

reconciliations, and cash disbursements. Controls over Check Enforcement Bureau credits should be strengthened.

§ The County Attorney’s Office does not independently track accounts receivable from their Drug Diversion program.

Countywide Fixed Assets ~ March 2003

The Department of Finance (DOF) administers and records the receipt, transfer, and disposal of fixed assets, while each department is responsible for reporting, maintaining, and effectively using these assets. The County’s fixed asset threshold includes items costing more than $5,000 and lasting more than one year. Fixed assets are categorized as land, buildings, improvements other than buildings, and machinery and equipment.

Significant Issues § Potentially sensitive or proprietary data files are not effectively removed from retired computers. § Year-end physical inventories are not effectively performed and need to be improved. § Asset accountability needs to be improved through enhanced policies and performance measures.


Customer Service Survey ~ January 2003

We conducted a customer service performance survey at the request of the County Administrative Officer. We placed 210 phone calls and made 14 walk-in site visits to assess the level of customer service offered by various County departments. We focused on citizen-contact departments and calls were made within 10 minutes of opening or closing time. The cost of the audit was $9,984.

§ Rating of telephone calls: Excellent—13% Satisfactory—84% Unsatisfactory—3% § Rating of walk- in visits: Satisfactory —71% Unsatisfactory—29%

Phone CallsExcellent

16%

Not Satisfactory

3%

Satisfactory81%

Walk-Ins

Not Satisfactory

29%Satisfactory

71%

Entrance & Exit of Elected Officials ~ May 2003

Entrance/Exit reviews are limited scope engagements, the objective of which is to ensure fixed assets, cash and change funds, bank accounts, and physical security items such as keys and combinations, are accounted for and passed intact to the newly elected official. The reviews are performed within each

County office for which a new official is elected. Re-elected officials are not reviewed. In November 2002, a County Supervisor, two Justices of the Peace, and three Constables replaced incumbents and were selected for our review. The County Supervisor was initially appointed to a vacant Board position.

Significant Issues § We found no major issues that would affect the newly elected officials in assuming their offices. § Minor issues were noted and are summarized in the report.


Facilities Management Inventories ~ July 2003

The audit objective was to ensure that County inventories are properly valued, reported, and safeguarded. County departments reported a total of $7,320,000 in inventories at the close of fiscal year 2002. Audit performed a risk

assessment of the five inventories listed and selected the Facilities Management (FMD) inventories for testing. FMD maintains an inventory of parts and supplies for use in repairing and maintaining County facilities.

Significant Issue § Facilities Management should enhance controls over the parts inventory records, valuation, and

surplus office furniture inventory.

Financial Condition Report FY02 ~ June 2003

The Financial Condition Report annually assesses Maricopa County’s financial condition. The report extensively uses graphics to create a highly visual, user-friendly, and interesting report for the benefit of elected officials, management, and the public.

Significant Issues § Although the County’s general financial condition and trends were found to be favorable, threats

from slowing sales tax revenues, declining health system cash flows, and health plan market share losses pose significant threats to future financial condition trends.

§ Maricopa’s low debt level compares very favorably with the average of benchmark counties. § Maricopa increasingly relies on sales tax revenues relative to property tax revenues. Accordingly,

Maricopa feels the effects of a slowing economy more directly.

Flood Control District ~ December 2002

The Flood Control District (FCD) provides regional flood control within Maricopa County and local flood protection in unincorporated county areas. The District is governed by a Board of Directors comprised of the Board of Supervisors that

appoints a seven person Flood Control Advisory Board to make recommendations regarding FCD policies and Capital Improvement Program projects.

Significant Issues § FCD complies with mandates that regulate inspection and maintenance of flood control structures. § FCD does not regularly enforce requirements established by sand and gravel mine operator

permits. § Many activities remain to be completed for the County to submit a federal water quality program

permit by the March 2003 deadline and avoid a possible $31,000 daily fine for non-compliance. § Significant procedural control weaknesses expose FCD to financial risk in the processing of

contractor invoices.


Grant Compliance Review ~ April 2003

In 1984, the United States Congress passed the Single Audit Act. The Federal Office of Management and Budget implemented the Single Audit Act, requiring recipients who annually receive $300,000 or more of federal assistance to undergo a comprehensive financial and compliance audit each year. As required

by federal guidelines, we reviewed 36 independent audit reports of community based organizations that received $12.1 million in County distributed federal grants.

Significant Issue § Twelve of the audit reports contain 31 findings related to County pass-through dollars. Only

five of the 31 findings are material and none directly affect the County or specific programs funded by the County.

Grant Management ~ April 2003

Maricopa County annually receives millions of dollars in grant funds from federal, state, and local agencies to support various services and programs. In FY 2002 the County received $138 million in grant funds. The four largest FY 2002 grant holders were Adult Probation, Human Services, Public Health, and

Juvenile Probation.

Significant Issues § With only minor exceptions, the departments we reviewed were adequately monitoring grants and

processing reimbursement requests. § County policies outlining grant responsibilities should be updated.

Health Care Mandates - July 2003

Maricopa County created the Health Care Mandates Department (HCM) to aggressively defend itself against groundless pre-AHCCCS claims from outside hospitals and medical eligibility lawsuits. HCM also reviews Correctional

Health Services claims, documents Disproportionate Share transactions with the State, and monitors Maricopa Integrated Health System’s General Fund subsidies.

Significant Issues § HCM’s claims system access controls could be strengthened to ensure the integrity,

confidentiality, and availability of information. § HCM’s expenditure controls appear inadequate to ensure that financial transactions are properly

recorded. HCM has utilized its budget to pay for services attributable to other County departments.


Integrated Justice System - September 2002

This review was performed to evaluate the design, management controls, and execution of the Integrated Criminal Justice Information System (ICJIS) implementation. The scope of the audit included evaluating project management

controls. The work was performed by an outside firm. The firm’s industry-tested Project Risk Management Methodology was used to evaluate the design and effectiveness of controls surrounding the ICJIS implementation. Significant Issues § The controls over the ICJIS project are designed appropriately, but are not functioning effectively. § Failure to apply effective management controls, over the implementation effort, significantly

increases the risk that ICJIS implementation objectives will not be met.

Justice Courts Review and MAS - May 2003

The Minimum Accounting Standards (MAS) review is an agreed-upon procedures engagement. An independent accountant performs standard audit procedures set forth by the Administrative Office of the Arizona Supreme Court. The purpose of

the engagement is to ensure that Maricopa County courts maintain effective internal control procedures over financial accounting and reporting systems.

Significant Issues § The Justice Courts have not developed formal, written procedures for reporting fraud issues at

court locations. § All eight Justice Courts’ comply with most MAS requirements, but some exceptions were noted. § Three of five Justice Court key results measures tested were reported inaccurately.

Internal Audit Peer Review - June 2003

An independent local accounting firm under the direction of the Board of Supervisor’s Citizens Audit Advisory Committee conducted an external quality control review of Maricopa County Internal Audit. The firm conducting the review reported that Maricopa Internal Audit was in full

compliance with government auditing standards for the three-year period reviewed. The report showed no major findings and contained only minor suggestions for improvement.

Significant Issues § The reviewer provided Internal Audit with a management letter offering suggestions for

improvement. § Some improvement suggestions resulted from a transition from traditional hard copy workpapers

to computer file workpapers.

Maricopa County Performance Report ~ July 2003

This report shows the potential for publishing a comprehensive County performance report that will clearly illustrate the relationship between department resources and services delivered to citizens. The report features performance data for two departments:

Public Health and Environmental Services. This report provides: § Examples of department resource expenditures compared with related productivity and service

accomplishments. § Illustrations of performance trends over three-to-five year periods. § Overviews of departmental operations.

Justice Facilities Expenditures ~ June 2003

Maricopa County voters approved Propositions 400 and 401 in November 1998 which authorized a $0.002 excise tax to be used by the County to design, construct, and operate new jail facilities. The Jail Tax, which began January 1, 1999, was to remain in effect for nine years or until collections

reach $900 million. The Jail Tax also supports programs aimed at reducing the County’s overall jail population. Significant Issues § Expenditures for justice facilities construction contracts are properly approved in compliance with

the Maricopa County Procurement Code and contract provisions. § Construction contract change orders are made in accordance with the requirements established by

the Procurement Code and the Board of Supervisors.


MCSO Warehouse & Food Services ~ April 2003

The Maricopa County Sheriff Office (MCSO) Central Warehouse stores food, clothing, and detention/enforcement supplies for MCSO, as well as some supply inventories for other County departments. The Warehouse accepts departmental

surplus assets and arranges sealed bid sales. The MCSO Custody Command is responsible for the Food Services Kitchen/Warehouse, daily preparation of inmate meals, the Distribution/Donated Food Program, and procuring and transporting donated food, inmate meals, and other supplies.

Significant Issues § County surplus lacks effective monitoring controls; significant weaknesses were noted with

surplus sale cash receipts. § Processes in place do not adequately safeguard and properly value inventories.


Medical Examiner ~ June 2003

The Office of the Medical Examiner (OME) conducts medical and legal investigations of unattended, violent, unexpected or suspicious deaths and reviews and authorizes all cremations.

Significant Issues § The OME rate and fee schedule should be updated to reflect accurate costs of providing goods and

services to external entities. § OME should consider enhancing revenue through Intergovernmental Agreements with Arizona

counties.

MIHS Claims System ~ July 2003

The Maricopa Integrated Health System (MIHS) began a project to implement a new claims system in January 2001 to replace multiple legacy applications processing systems. A primary driver for the project was to comply with the Health Insurance Portability and Accountability Act (HIPPA), which could not be

achieved with the legacy systems. MIHS contracted with a vendor to develop several significant customizations to the claims base system to meet unique processing requirements.

Significant Issues § Access security controls need to be improved to protect sensitive information. § Controls over program changes and segregation of dut ies should be improved. § The most current software updates have not been installed to the claims system.

MIHS Cash Monitoring ~ Monthly 2003

Internal Audit (IA) researches and prepares a monthly report showing the Maricopa Integrated Health System’s (MIHS) updated cash status. This is the second fiscal year IA has engaged in

continuous MIHS cash monitoring. The first year, IA alerted County management and MIHS management of a precipitous decline in MIHS cash balances. This year, IA monitored and reported MIHS cash trends. MIHS, largely as a result of the increased awareness of negative cash trends, has taken measures to stabilize and more effectively manage cash. However, MIHS operating cash continues to be problematic, especially as it’s largest health plan market share declines, reducing the largest source of MIHS positive cash flow.

MIHS Cash Trend (Millions)

$0

$10

$20

$30

$40

$50

May-01

Aug-0

1Nov-

01Feb

-02May-

02Au

g-02

Nov-02

Feb-03

May-03

Maricopa County Internal Audit County Auditor’s Annual Report

MIHS Durable Medical Equipment - July 2003

We reviewed the Maricopa Integrated Health System (MIHS) contract with a durable medical equipment vendor. Physicians often prescribe durable medical equipment to be used by beneficiaries in their home, such as, canes, crutches, walkers, commode chairs, home oxygen equipment, hospital beds, and wheelchairs.

Significant Issues § Some payments made to the contractor were missing required authorizations, which increases the

risk of payments being made for inappropriate time spans and/or inappropriate equipment. § Our testing detected price discrepancies between the contract's vendor price schedules and claim

payment amounts. This control weakness exposes the County to financial risk.

MIHS Finance /Accounting System ~ July 2003

The Maricopa Integrated Health System (MIHS) Finance Department provides financial reporting and analysis support for MIHS and processes account payments chargeable to MIHS. The STAR IT application contains several

modules that include General and Patient Accounting. Significant Issues § Our review found $220,000 in contract payments lacking appropriate Board of Supervisors’

authorization, and control weaknesses that expose the County to legal and financial risk. § The MIHS Finance Department does not take advantage of prompt payment discounts. § IT controls need to be improved to ensure confidentiality, integrity, and availability of the finance

system.

MIHS Medical Supplies Inventory ~ May 2003

The Maricopa Integrated Health System (MIHS) Materials Management unit manages medical supplies for the Medical Center. These supplies are primarily non-reusable medical, surgical, laboratory, respiratory, and burn items, excluding pharmaceuticals. Purchasing and warehouse operations report to the Materials Management Director and accounts payable operations report to the Hospital Controller.

Significant Issues § The MIHS financial system inventory balance did not agree with an actual count of MIHS

warehouse inventory by $64,000, a 15% variance. A significant variance ($136,000 or 30%) was also found between the MIHS Finance General Ledger balance and the inventory system balance.

§ Various hospital units report that warehouse customer service has improved but that areas of dissatisfaction still exist. Filling hospital and patient supply needs quickly and efficiently is important for successful operations.


MIHS Senior Select Health Plan ~ July 2003

The Maricopa Integrated Health System (MIHS) Senior Select Health Plan (MSSP) is a “Medicare+Choice HMO” Plan offered to individuals who are eligible to receive Medicare benefits.

Significant Issues § MIHS is soliciting bids from contractors to assume full risk for all MSSP member medical

expenses to help minimize the financial risk associated with retaining MSSP. § Effective July 1, 2002, the Center for Medicare and Medicaid Services (CMS) placed a

membership enrollment cap sanction on MSSP resulting from CMS audit findings. Our testing showed that MIHS still does not meet CMS’ claim payment timeframes.

§ MIHS stresses MSSP referral contribution to the delivery system as a factor for keeping the plan, however, MSSP members do not significantly utilize MIHS' delivery system.

Office of Management & Budget ~ July 2003

Our work in OMB this year took the form of a Control Self-Assessment (CSA) Workshop. The CSA format and objective were selected through a formal risk-assessment process. The engagement focused on the improvement of communications between OMB and Maricopa Integrated

Health Systems. The CSA format allowed parties to surface issues, share opinions and feelings about the issues, and suggest improvements going forward.

Significant Issue A facilitated workshop was held at an off-site location, hosted by Internal Audit (IA), and attended by MIHS and OMB management. The workshop format was open discussion with IA acting as facilitator. During the months preceding the workshop and during the workshop itself, several issues were clarified and ideas for communication improvement were agreed upon.

Network Vulnerability ~ April 2003

The Maricopa County network is comprised of multiple internal networks that facilitate communication between and around County agencies, departments, and systems. The scope of the audit was to determine if adequate security and controls exist for internal County networks to prevent unauthorized intrusions

that could potentially disrupt or damage County networks.

Significant Issues § Many County systems are accessible from a single location in the County network.

Telecommunications is in the process of creating restrictions within the County’s network to limit the risk that the entire network can be compromised.

§ Many County systems are vulnerable to compromise because they are not configured properly, have unnecessary services enabled, or have not received the most current vendor updates.


Random Cash Counts ~ January 2003

Internal Audit performed a serious of random cash and check counts of three County departments: the Office of the Medical Examiner, the Environmental Services Department, and the Planning and Development Department. The control procedures

of each of the departments were also reviewed.

Significant Issues Internal Audit found no significant exceptions to physical counts of cash and checks during our testing procedures. However, some significant control weaknesses were noted in each of the three County departments.

Risk Management ~ February 2003

Maricopa County created its Risk Management Department in 1981 to administer the County’s self- insurance trust fund. State statutes authorize counties to establish

a self- insurance program to fund employee benefits, pay for property loss or lawsuit claims, and to conduct loss prevention consultation. Risk Management’s mission is to provide loss prevention and control, and to manage insurance and claims services for Maricopa County government in order to reduce or eliminate County losses.

Significant Issues § County controls need to be strengthened over planning and conducting fire drills in all of its facilities

(owned, leased, and courts). § Risk Management has done a good job of monitoring the performance of workers compensation.

claims processing by a contractor.

Performance Measures ~ July 2003

Internal Audit’s performance measure certification program (PMC) enables County leaders to rely upon reported performance measures to make

informed decisions concerning government resources. PMC reviews determine the accuracy of reported measures and the reliability of data collection procedures.

Significant Issue In FY 2003 Internal Audit reviewed 42 performance measures from 10 departments. We found that only 52% of these measures were accurate. FY 2002’s certification results were more favorable, most likely because FY 2002 was a start-up year, and only data from volunteer departments were used.

Certification Audit ResultsFY 2003

40%

12%34%

14%

Certified as accurate

Certified as accurate but without adequate procedures

Data could not be verified

Inaccurate


Stadium District ~ July 2003

The Stadium District mission is to provide fiscal resources for Cactus League Facilities and asset management of Bank One Ballpark for the community so they can attend Cactus League spring training, Major League Baseball games, and other events in state-of-the-art, well-maintained facilities.

Significant Issues We reviewed two of five construction contracts and found no exceptions. We reviewed financial and program controls through the completion of Internal Control Questionnaires and found no material exceptions. During our review, we found that rental car surcharge revenue is effectively monitored. We also found that controls over one-time event revenue will be improved in FY 2003 by making the review part of the annual independent financial audit.

Transportation ~ July 2003

The Maricopa County Department of Transportation (MCDOT) has established goals to be the regional transportation authority, develop and operate a regional transportation system, and increase the safety and capacity of the existing

transportation system. MCDOT’s funding is derived largely from State of Arizona Highway User Revenue Fees (HURF). MCDOT generates additional revenues from intergovernmental agreements (IGAs) with the state, cities, and developers that share costs in construction projects.

Significant Issues § The MCDOT billing process, for services to other agencies, does not include all applicable costs,

which resulted in $21,000 in unbilled charges. § MCDOT generally complies with County requirements for procuring design and construction

contracts, however file documentation should be improved. § General controls over security and program changes for MCDOT systems need to be improved.

Solid Waste Management ~ October 2002

The Solid Waste Management Department (SW) operates under laws that require the County to provide public facilities for the safe and sanitary disposal of solid waste and waste tires. SW operates six transfer stations, monitors six closed landfills, and accepts tires for recycling at two County locations. The department cooperates with private entities to manage solid and special wastes. SW also monitors landfill environmental water and gas emissions and maintains closed

landfills. Significant Issues Our testing of SW records found that tire data is accurately recorded on a regular basis. Our review of contracts, billings, supporting documentation, and monitoring activities found $700 of overpayments and control weaknesses that expose the County to risk. SW has not established cash and deposit controls adequate to safeguard County funds.

§ Board of Supervisors Progress Reports ~ Monthly Internal Audit’s charter requires us to update Board members on our activities monthly.

§ Consultations ~ Throughout the Year We provide consultations requested by departments via the Board of Supervisors. We consulted on the following projects: � Capital Facilities Development Special Request � County Attorney Defensive Driving Fees � Disaster Recovery Plan � Eagle — HRMS

§ Control Self Assessment Classes ~ Throughout the Year One hundred and six County employees attended one of three Internal Audit Control Self Assessment (CSA) classes to improve their understanding of good contract monitoring, cash handling practices, and processing payables. We presented a total of eight classes.

§ Corporate Review Committee ~ Ongoing Internal Audit participates on this committee which reviews departments’ strategic plans and provides recommendations to the departments and to the Board of Supervisors.

§ Electronic Government Council ~ Ongoing Internal Audit participates on a task force that provides the CIO and Executive Management input on future County direction in EGov applications, website development, and interfacing with state and other jurisdictions.

§ ICJIS SDLC Development ~ Ongoing On-going monitoring over the Integrated Criminal Justice Information System (ICJIS) project. Areas of review and monitoring include: budgets, project management, time schedules (deadlines), and security. Information is reported to the Board and Presiding Judge.

§ Legislative Impact ~ May 2003 We compiled data and prepared two handouts for Government Relations & Communications: an attractive one page listing of how cuts in state revenues affect County services to citizens (presented 10/17/02); a comprehensive listing of County services (presented 10/30/02). Government Relations used this information to illustrate to the State legislature how valuable County services are to citizens and how any State cuts to revenues will affect these services.

§ Management Control Bulletins (“Got Controls”) ~ Ongoing We created a one-page information bulletin entitled “Got Controls?” to communicate important control issues to County executives, managers, and employees. These bulletins feature useful common internal control issues. The bulletins issued for FY 2003 are: publicity control, safety, and public records.

§ Risk Assessment ~ August - December 2002 The Countywide risk assessment is a necessary planning tool that helps determine high, low, and medium risk areas that should be audited and reviewed. This tool is a precursor to the audit plan.


Appendix C: Other Projects

� HIPPA � Parking Special Request � Security Force for the County � Treasurer’s Investments


Appendix D: Single Audit Reviews

As mandated by OMB Circular A-133, we reviewed subrecipient Single Audit Reports for FY 2000-2001 & CY 2001.

Maricopa County passed through $12.1 million of federal grant funds to 36 subrecipients, required to undergo a Single Audit, in FY 2000-2001/CY 2001. We reviewed 36 subrecipient Single Audit Reports and found that twelve contained a total of 31 findings related to County pass-through dollars. Only five of the findings are material and indirectly affect the County or specific County programs. Internal Audit will follow up on one overdue Single Audit Report. The subrecipients are:

§ Pass Through Agency ~ Maricopa County Department of Community Development

City of Surprise (FY 00)

§ Pass Through Agency ~ Maricopa County Department of Environmental Services

Regional Public Transportation Authority

§ Pass Through Agency ~ Maricopa County Department of Human Services

Advocates for the Disabled, American Red Cross, Arizona Call-A-Teen Youth Resources, Catholic Social Services, City of Avondale, City of El Mirage, City of Glendale, City of Tolleson, Community Services of Arizona, East Valley Institute of Technology, Foundation for Senior Living, Maricopa County Community College District, New Life Center, Regional Public Transportation Authority, Save the Family, Southwest Human Development, Tempe Community Action Agency, Town of Gila Bend, Town of Guadalupe.

§ Pass Through Agency ~ Maricopa County Juvenile Probation

City of Glendale, City of Phoenix.

§ Pass Through Agency ~ Maricopa Integrated Health System

Area Agency on Aging, Body Positive, Concilio Latino de Salud (Oct 01), Ebony House.

§ Pass Through Agency ~ Maricopa County Department of Public Health

Aids Project Arizona, Area Agency on Aging, Body Positive, Catholic Social Services, Clinic Adelante (Nov 01), Concilio Latino de Salud (Oct 01), Mountain Park Health Center (Nov 01), Native American Community Health (Sept 00), Phoenix Shanti Group.

§ Pass Through Agency ~ Maricopa County Sheriff's Office

City of Chandler, City of Mesa.


Definition Internal auditing is an independent, objective assurance and consulting activity that adds value and improves operations. Internal auditing helps an organization reach objectives by bringing a systematic, disciplined approach to improve the effectiveness of risk management, control, and governance processes. Mission The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board of Supervisors can make informed decisions to better serve County citizens. Vision To facilitate positive change throughout County operations while ensuring that public resources are used for their intended purpose. History The Board of Supervisors appointed the first County Auditor in 1978 and established an internal audit function. In 1994, the Board of Supervisors created a Citizen’s Audit Advisory Committee comprised of private citizens and County officials. (See Appendix F for charter.) In 1997, the Board of Supervisors formalized the County’s internal audit function by adopting a department charter, which was amended in December 2002. (See Appendix G for charter.) Citizen’s Audit Advisory Committee (Audit Committee) The Board Appointed Citizens’ Audit Advisory Committee supports further strengthening of the County’s Internal Audit Department. This committee, comprised of accounting and business professionals, actively engages in analyzing risk throughout the County and making recommendations. This committee is an important link between the Board of Supervisors and the County’s auditors, both internal and external. The Maricopa County Citizen’s Audit Advisory Committee meets regularly to review and comment on audit reports, County financial statements, and other audit information (audit plan, special requests, etc.). Organizational Independence Auditors should be removed from organizational and political pressures to ensure objectivity. As our charter designates, the Maricopa County Internal Audit Department reports directly to an elected board of supervisors thereby establishing an effective level of independence from management. This reporting structure provides the Board of Supervisors with a direct line of communication to Internal Audit and provides assurance that County officials cannot influence the nature or scope of audit work performed. Government Auditing Standards support locating internal audit departments’ outside the management function in order to encourage independence. Routine meetings with an independent audit committee further enhance independence. The County Auditor also meets with an oversight committee comprised of the County Administrative Officer and two Board members.

Appendix E: Internal Audit Department Profile


Resources A fully staffed and professionally competent internal audit department provides value-added services to the County. Each year Internal Audit analyzes and adapts its resources to meet upcoming County auditing and consulting needs. To provide flexibility, the audit staff has education and experience in various audit areas: finance, performance, information systems, and management services. Each audit is performed by a team that collectively possesses the necessary knowledge and skills to fit the assignment. Government operations are inherently complex; certain functions cannot be properly reviewed without specialized expertise. Hiring a wide variety of staff specialists, however, would not be cost-beneficial. While we have invested in qualified internal staff, we have also reserved resources for specialized contractors; $370,000 was budgeted for this purpose in FY2002-2003. This partnership (called “co-sourcing”) provides the County with the collective expertise required by Government Auditing Standards at an affordable price.

The County’s Health System is large (approximately 1/3 of the County’s budget), very complex, and affects many peoples' lives. This high level of risk to the County makes the Health System’s activities worthy of increased scrutiny. We began performing health care audits in fiscal year 1997-1998. In fiscal year 1999-2000, we began outsourcing the health system audits due to the highly specialized expertise required.

Audit Committee

Internal Audit County Management

Board of Supervisors

Reporting Structure of the Internal Audit Department

FY 2003 Internal Audit Department Organizational Chart

Office Manager

Senior Auditor

Senior Auditor

Associate Auditor

Audit ManagerManagement Services

Senior Auditor

Associate Auditor

Associate Auditor

Audit ManagerPerformance Audit Services

Associate Auditor

Associate Auditor

Staff Auditor

Audit ManagerFinance Audit Services

Senior Auditor

Audit ManagerInformation Technology

County Auditor


Risk Assessment

Effective internal auditing is based upon systematically reviewing an organization’s operations at intervals commensurate with associated risks. The annual risk-review process produces an audit plan that maximizes audit coverage and minimizes risk. Auditing every County activity on a regular basis would not be cost efficient; professional judgment ensures resources are focused on high-risk areas. Professional Internal Audit Staff Our auditors have extensive knowledge of auditing methods and techniques plus specialized training in computers and accounting. (See Appendix A for individual biographies.) Each auditor is responsible for maintaining Government Auditing Standards requirements of 80 continuing education hours every two years; 24 of those hours are directly related to government operations. In order to meet this education requirement and share knowledge, Internal Audit staff members conducted five in-house training classes in FY03 at a cost savings ranging from $595 to $1,190 (assuming $10 to $20 per credit hour). Who Audits the Auditors? (Peer Review) An independent audit firm conducts a peer review of Internal Audit every 3 years, as required by national Government Auditing standards. The Maricopa County Citizens’ Audit Advisory Committee oversees these reviews. The FY 2000 and FY 2003 review by a local firm showed no findings.

Appendix F: Charter of the Maricopa County

Citizen’s Audit Advisory Committee

The committee’s primary function is to assist the board of supervisors in fulfilling its oversight responsibilities. The committee accomplishes this function by reviewing the county’s financial information, the established systems of internal controls, and the audit process.

In meeting its responsibilities, the committee shall perform the duties outlined below. 1. Provide an open avenue of communication between the county auditor, the auditor general, and the

board of supervisors. 2. Review the committee's charter annually and seek board approval on any recommended changes. 3. Inquire of management, the county auditor, and the auditor general about significant risks or

exposures and assess the steps management has taken to minimize such risks to the county. 4. Consider and review the audit scope and plan of the county auditor, and receive regular updates on

the auditor general’s county audit activities. 5. Review with the county auditor and the auditor general the coordination of audit efforts to assure

completeness of coverage, reduction of redundant efforts, and the effective use of all audit resources including external auditors and consulting activities.

6. Consider and review with the county auditor and the auditor general: a. The adequacy of the county's internal controls including computerized information system

controls and security.

b. Any related significant findings and recommendations of the auditor general and the county auditor together with management's responses thereto.

7. At the completion of the auditor general’s annual examination, the committee shall review the

following: a. The county's annual financial statements and related footnotes. b. The auditor general's audit of the financial statements and report thereon.

c. Any serious difficulties or other matters related to the conduct of the audit that need to

be communicated to the committee.



Charter ~ Page Two 8. Consider and review with management and the county auditor: a. Significant audit findings during the year and management's responses thereto.

b. Any difficulties encountered during their audits, including any restrictions on the scope of their work or access to required information.

c. Any changes required in the planned scope of their audit plan. d. The internal audit department's budget and staffing. e. The internal audit department's charter. f. The internal audit department's overall performance and its compliance with accepted

standards for the professional practice of internal auditing. 9. Report committee actions to the board of supervisors with such recommendations as the committee

may deem appropriate. 10. Prepare a letter for inclusion in the annual report that describes the committee's composition and

responsibilities, and how they were discharged. 11. The committee shall meet at least four times per year or more frequently as circumstances require.

The committee may ask members of management or others to attend the meetings and provide pertinent information as necessary. Committee meetings are subject to the Open Meeting Law (A.R.S. § 38-431).

12. The committee shall perform such other functions as assigned by the board of supervisors. Committee Composition and Terms The membership of the committee shall consist of five voting members and three non-voting members. The voting members shall be board of supervisor appointees from the public and shall serve two-year terms. The non-voting members shall be the county’s chief financial officer, the county attorney, the auditor general, or their designees. The chairman of the board of supervisors shall appoint a committee chairman from the voting members. The committee chairman shall serve a one-year term. Member Qualifications Committee members must have an understanding of financial reporting, accounting, or auditing. This understanding can be demonstrated through educational degrees (BS, MBA, PhD) and professional certifications (CPA, CMA, CIA), or through experience in managing an organization of more than 25 employees or $20M in revenues. Committee members should be familiar with local government operations and should have sufficient time to effectively perform the duties listed herein. Adopted by the Board of Supervisors — 3/26/97 Last Amended — 6/26/02

Appendix G: Internal Audit Department Charter

Purpose The Maricopa County Board of Supervisors (Board) hereby establishes the Maricopa County Internal Audit Department. The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board and management can make informed decisions to better serve County citizens.

Responsibility County management has primary responsibility for establishing and maintaining an effective system of internal controls. Internal Audit evaluates the adequacy of the internal control environment, the operating environment, related accounting, financial, and operational policies, and reports the results accordingly.

Authority and Access

Internal Audit is established by the powers granted to the Board in A.R.S. § 11-251. The Board is authorized to supervise the official conduct of all County officers, to see that such officers faithfully perform their duties, and present their books and accounts for inspection (A.R.S. § 11-251.1). The Board is also authorized to perform all other acts and things necessary to fully discharge its duties (A.R.S. § 11-251.30). Internal Audit will report directly to the Board, with an advisory reporting relationship to the Board-Appointed Citizen’s Audit Advisory Committee. In addition, the County Auditor will meet, as needed, with an oversight committee comprised of the County Administrative Officer and two Board members appointed by the Board Chairman. While conducting approved audit work, Internal Audit will have complete access (except where restricted by legal privilege) to all County property, records, information, and personnel.

Premise and Objectives

Internal Audit’s basic premise is that County resources are to be applied efficiently, economically, and effectively to achieve the purposes for which the resources were furnished. This premise is incorporated in the following four objectives: A. Compliance with Laws and Regulations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure identification of and compliance with applicable laws and regulations. B. Effective Program Operations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that programs meet their goals and objectives.


Charter ~ Page Two

C. Validity and Reliability of Data Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that valid and reliable data are obtained, maintained, and fairly disclosed. D. Safeguarding of Resources Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that resources are safeguarded against waste, loss, and misuse.

Independence

The Internal Audit Department will remain outside the control of management. Internal Audit employees will have no direct responsibility for, or authority over, any of the activities, functions, or tasks reviewed by the department. Accordingly, Internal Audit staff should not develop or write policies and procedures that they may later be called upon to evaluate. They may review draft materials developed by management for propriety and completeness. However, ownership of and responsibility for these materials will remain with management.

Audit Standards and Ethics

Internal Audit will adhere to applicable industry standards and codes of ethics issued by authoritative sources (such as those issued by the Institute of Internal Auditors and the U.S. General Accounting Office). Each member of the department is expected to consistently demonstrate high standards of conduct and ethics as well as appropriate judgment and discretion.

Audit Planning

The County Auditor will prepare an annual audit plan that will be reviewed by the Citizen’s Audit Advisory Committee and approved by the Board. Additions, deletions, or deferrals to the annual audit plan will also be approved by the Board.

Follow-Up

Internal Audit will follow up on the status of its report recommendations on a regular basis. Adopted by the Board of Supervisors — 6/11/97 Last Amended — 12/18/02


Maricopa County Internal Audit 301 W. Jefferson, Suite 1090 Phoenix, AZ 85003 ~ 2148

Telephone: 602 ~ 506 ~ 1585 Facsimile: 602 ~ 506 ~ 8957 E-mail: [email protected]

Visit our website @ www.maricopa.gov/internal_audit


maricopa county internal audit department report... · 2002 achievement award performance measure...

Documents